``GNU wget is a free software package for retrieving files using HTTP,
HTTPS and FTP, the most widely-used Internet protocols. It is a
non-interactive commandline tool, so it may easily be called from
scripts, cron jobs, terminals without X-Windows [sic!] support, etc.''

-- http://www.gnu.org/software/wget/wget.html

wget(1) is the de facto standard HTTP retrieval program on GNU/Linux,
both for interactive use and for use in scripts and programs. 76
packages in the Debian Sarge currently depend on the wget package.

In the current maintainer's own words: ``[T]he code is buggy, poorly
commented, very hard to understand, extremely resistant to changes and
looks like a bunch of patches put together in a careless way.
[I]t badly needs a lot of auditing and rewriting.''

-- Mauro Tortonesi in a private mail exchange with me

Note: Wget has numerous commandline options which are relevant to these
vulnerabilities.

(1) Wget doesn't know which files it is permitted to write to

Wget erroneously thinks that the current directory is a fair game, and
will happily write in any file in and below it. Malicious HTTP response
or malicious HTML file can redirect wget to a file that is vital to the
system, and wget will create/append/overwrite it.

$ cd /home/user
$ wget http://localhost/wgettrap.bashrc
-> .bashrc

(2) Wget doesn't sanitize the redirection data properly

Wget apparently has at least two methods of ``sanitizing'' the
potentially malicious data it receives from the HTTP stream, therefore a
malicious redirects can pass the check. We haven't find a way to trick
wget into writing above the parent directory, which doesn't mean it's
not possible.

We discovered this bug few months earlier. We contacted the Debian
package maintainer and the Debian Security Team on 2004-10-03. The wget
maintainer had not been responding to emails at that time, so we didn't
contact him. Few days ago, a new maintainer was appointed, who
[1]disclosed this vulnerability.